Outsourced B2B lead generation: UK rules

How outsourced B2B lead generation works

Outsourced B2B lead generation is paying an outside provider to find and contact other businesses on your behalf. The provider builds or buys a list of target companies and business contacts, reaches them by live phone calls, emails, texts, social media messages or post, and passes interested prospects to the in-house sales team to follow up.

Outsourcing is one of several routes within lead generation services, alongside paid search, local search visibility and websites built to capture enquiries. When comparing proposals, it helps to ask what a quoted fee includes, what counts as an accepted lead, and how unsuccessful or duplicate handovers are dealt with.

B2B marketing is when direct marketing is sent to another business or a business contact, and direct marketing covers all types of advertising, marketing or promotional material. The B2B rules differ from the rules for contacting the public in a few specific ways, set out below.

Which prospects count as business contacts?

In general, the PECR marketing rules apply equally to corporate subscribers and individual subscribers; the main difference is that the rule on marketing by electronic mail, such as email or text, doesn't apply to corporate subscribers.

Sole traders and some partnerships are treated as individuals, so they can only be emailed or texted with their specific consent or under the soft opt-in, which needs the contact details to have been obtained in the course of a sale or negotiation of a sale of the sender's own similar product or service, and a clear chance to opt out when the details were collected and in every message. ^[2]

Someone using an online platform in their personal, albeit professional, capacity is not a B2B contact either: sending them direct marketing messages is not considered B2B marketing.

The guide to choosing a lead generation provider covers the provider's role, and the guide to mortgage lead generation shows how these rules play out in one consumer-facing sector.

Businesses are classed as corporate subscribers under PECR if they are a corporate body with separate legal status, such as companies, limited liability partnerships, Scottish partnerships and some government bodies. ^[1]

Named contacts, generic addresses and bought lists

If the name of the person being contacted at a business is not known, no personal data is being processed and the UK GDPR does not apply to the marketing, as with post addressed simply to the IT department.

If an individual's contact details are collected in their business capacity for direct marketing, they must be told about this and there must be a lawful basis under the UK GDPR for the processing. The two lawful bases most relevant in B2B marketing are consent and legitimate interests.

Before using data broking services, appropriate due diligence is needed to be satisfied that the personal data on offer complies with the GDPR, DPA 2018 and, if applicable, PECR, and simply accepting a broker's assurances is not enough. Where personal data is collected from sources other than the individual, such as bought or rented lists, privacy information must be provided within a reasonable period of obtaining the data and no later than one month from the date of collection, unless an exception applies. ^[3]

The ICO guidance on data brokers is under review following changes made by the Data (Use and Access) Act, so it is worth checking the current version. ^[3]

Phoning companies: live and automated calls

Before live B2B calls, numbers need to be screened against both the CTPS and TPS registers, as well as the caller's own do not call list.

The calling company's own telephone number should be displayed when making direct marketing calls to businesses. Automated direct marketing calls to businesses need the business's consent, and that consent must specifically cover automated calls from the organisation making them.

Some live calls carry stricter rules: for claims management services, consent is needed to make live marketing calls.

When a provider phones companies on a client's behalf, it could be asked which registers it screens against, how recently, and how it keeps its own do not call list up to date.

Emailing companies, and marketing by post

The PECR rule on direct marketing by electronic mail does not apply to corporate subscribers, so consent under PECR is not needed to send B2B marketing emails or texts to a corporate body.

Electronic mail is intentionally broad and covers emails, text messages, picture or video messages, voicemails, direct messages via social media and similar stored messages.

If personal data is processed when sending marketing by electronic mail to another business, the UK GDPR applies, including the right to object to direct marketing.

It makes good business sense to keep a do not email or text list of corporate subscribers that object or opt out, and to screen new B2B lists against it.

If marketing is sent by post, PECR does not apply.

Marketing emails and texts must not disguise or conceal the sender's identity, and must give a valid contact address so recipients can opt out or unsubscribe. ^[2]

When a business prospect objects

Under PECR, businesses can object to live marketing calls and marketing faxes, and the CTPS and TPS act as a general objection to receiving live direct marketing calls.

If an individual withdraws their consent or objects, their personal data has to stop being processed for B2B marketing purposes.

A business's own objection does not have to be followed under the UK GDPR, although PECR may require it, and there is little purpose in continuing to send direct marketing to a business that has asked for it to stop.

Where a provider handles the outreach, it is worth checking how the objections it receives reach the client's suppression list, so that a prospect who has asked to stop is not contacted again through a different channel.